Windows 11 has DNS over HTTPS built into Settings, most people have never seen it, and it takes about five minutes to turn on. That is the pitch a recent XDA piece made, and it is right: encrypted DNS is the cheapest privacy upgrade on a Windows machine, and yet a majority of desktops still ship queries in the clear to whichever resolver the router hands them. Anyone on the same LAN, the ISP, and the coffee-shop AP can read every domain we look up.
We tested seven apps and setups for encrypted DNS on Windows, from the built-in DoH client in Windows 11 to the third-party clients that add filtering, per-app rules, and switching between DoH, DoT, and DoQ. Every one of them stops plaintext DNS leaks. The differences are in filtering, telemetry, and how much control we get over which app talks to which resolver.
What to look for in an encrypted DNS app for Windows
A good encrypted DNS client on Windows should do more than tunnel port 53:
- Support for DoH (DNS over HTTPS) at minimum, DoT (DNS over TLS) and DoQ (over QUIC) as a plus.
- Per-profile filtering (ads, trackers, adult, phishing) with allowlists and blocklists, so the resolver doubles as a content filter.
- Real logs of what got blocked, without shipping our browsing history to a broker.
- Per-network or per-app routing, so a work VPN can force queries down its tunnel while everything else uses our resolver.
- Split horizon or local-domain support, so
.local,.internal, and homelab hostnames still resolve. - A quiet, low-memory service, because a background daemon that pins a CPU is a non-starter.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price/mo | Rating |
|---|---|---|---|---|---|
| NextDNS | Configurable filtering with per-network profiles | Windows, macOS, Linux | 300k queries/mo | Modest yearly subscription | 4.8 / 5 on user reviews |
| ControlD | Custom DNS with per-app and geo-routing rules | Windows, macOS, Linux | Fully free tier | Modest yearly subscription | 4.8 / 5 |
| AdGuard DNS | Blocklist-first resolver | Windows, macOS, Linux | 300k queries/mo | Modest yearly subscription | 4.7 / 5 |
| Cloudflare WARP | Zero-config privacy with a tunnel option | Windows, macOS, Linux | Fully free | WARP+ modest monthly | 4.5 / 5 |
| Simple DNSCrypt | Free DNSCrypt / DoH front-end | Windows | Fully free, open source | Free | Community, GitHub |
| YogaDNS | Per-application DNS rules | Windows | Trial | Modest one-time license | Paid utility |
| DNSCrypt-Proxy | Headless resolver for power users | Windows, macOS, Linux | Fully free, open source | Free | GitHub project |
Windows 11’s built-in DoH client is the eighth pick — it is not an “app” in the store sense but it is the sensible baseline. We cover it last.
The apps
1. NextDNS
NextDNS is the pick if we want the setup of a hosted resolver plus the control of a self-hosted Pi-hole. The dashboard exposes filter groups (ads, trackers, adult, malware, phishing, cryptomining, gambling, dating) and every popular open blocklist. Per-profile analytics show which domains got queried and which got blocked, and the log-retention setting can be turned off entirely for teams that do not want a record kept. The Windows client sets up DoH in the OS and a per-profile switch for home versus work networks.
Where it falls short: the free tier caps at 300,000 queries a month, which most single desktops will slide under but a household will not. The dashboard has grown wide enough to feel like a small SIEM.
Pricing:
- Free: 300,000 queries per month
- Paid: modest yearly subscription for unlimited queries
Platforms: Windows, macOS, Linux, Android, iOS, routers
Download: NextDNS
Bottom line: the sensible pick for a single-user machine that wants strong filtering and honest analytics.
2. ControlD
ControlD ships one of the cleanest desktop clients in the space and its differentiator is per-application routing. We can point Chrome at one profile, Steam at another, and everything else at a third. Geo-unblocking, custom rules per domain, and a stack of pre-built filters (ads, trackers, malware, IoT telemetry) are all first-class. The company is a spin-off of the Windscribe VPN team, and the audit posture reflects that — no query logs kept, transparent uptime, third-party audits.
Where it falls short: the free tier is generous but the fine-grained rules live in the paid plan. The desktop app takes a beat to open on first launch.
Pricing:
- Free: fully free tier with core filtering
- Paid: modest yearly subscription for custom rules and per-app routing
Platforms: Windows, macOS, Linux, Android, iOS, routers
Download: ControlD
Bottom line: the pick for anyone who wants Chrome and the corporate VPN talking to different resolvers.
3. AdGuard DNS
AdGuard DNS is the resolver for someone who wants ad and tracker blocking as the default and not much else to configure. Two family-safe presets, per-server DoH endpoints, and a Windows client that binds every network interface to the encrypted upstream. Stats are shipped to the AdGuard dashboard only if we choose; the “no logs” resolver skips the analytics entirely.
Where it falls short: the customisation surface is thinner than NextDNS or ControlD. If we already run AdGuard Home on a server, this is redundant.
Pricing:
- Free: 300,000 queries per month
- Paid: modest yearly subscription for unlimited queries and premium filter feeds
Platforms: Windows, macOS, Linux, Android, iOS
Download: AdGuard DNS
Bottom line: the pick for a set-and-forget encrypted DNS that blocks ads out of the box.
4. Cloudflare WARP
Cloudflare WARP is the free option that needs no thinking. Install the client, sign in with an email, and every DNS query on the machine goes over an encrypted tunnel to Cloudflare’s 1.1.1.1 resolver. The premium WARP+ tier upgrades the transport to the Argo tunnel for a real latency win in bad-network regions, and Zero Trust WARP adds team-level policies for family or small-business use. It doubles as a light VPN, though a real VPN is still a better VPN.
Where it falls short: filtering is limited to Cloudflare’s 1.1.1.1 for Families blocklists. Everything about the app assumes a Cloudflare account.
Pricing:
- Free: unlimited encrypted DNS and light tunnel
- Paid: modest monthly WARP+ subscription for the Argo tier
Platforms: Windows, macOS, Linux, Android, iOS
Download: Cloudflare WARP
Bottom line: the free encrypted DNS with the lowest setup cost, and the safest pick if we cannot commit to a paid resolver.
5. Simple DNSCrypt
Simple DNSCrypt is the open-source, Windows-native front-end for the DNSCrypt Proxy. It ships with a curated list of public resolvers that support DNSCrypt v2, DoH, and DoT, and it wires them into the Windows resolver via loopback. Because everything runs local, there is no cloud account and no telemetry.
Where it falls short: the UI is functional, not polished. Per-app routing is not part of it. Anyone who wants filtering has to pick a resolver whose upstream already filters.
Pricing:
- Free: fully free, open source
- Paid: no paid tier
Platforms: Windows
Download: Simple DNSCrypt
Bottom line: the pick for anyone who wants encrypted DNS without a hosted account, and does not mind picking their own resolver.
6. YogaDNS
YogaDNS is a paid Windows utility that solves the per-application DNS problem more thoroughly than ControlD does. Rules can match on process name, IP range, or DNS query, and route each match to a different upstream over DoH, DoT, DNSCrypt, or plain UDP for local domains. For anyone who runs a mix of homelab services, a work VPN, and a personal browser on the same machine, YogaDNS is the tool that keeps them out of each other’s DNS tables.
Where it falls short: the UI shows its Windows-utility heritage. It is a paid utility rather than a hosted service, so filtering depends on which upstream we point rules at.
Pricing:
- Free: trial
- Paid: modest one-time license for the Pro edition
Platforms: Windows
Download: YogaDNS
Bottom line: the alternative when the “one resolver for everything” model does not fit.
7. DNSCrypt-Proxy
DNSCrypt-Proxy is the command-line resolver that Simple DNSCrypt wraps a UI around, and running it directly is a reasonable move for anyone comfortable in a config file. It supports DoH, DoT, DNSCrypt v2, Oblivious DoH, and anonymised DNS relaying. On Windows it runs as a service, listens on loopback, and takes an nsswitch-style config to route rules to upstreams. For anyone building a headless setup or scripting the resolver for reproducibility, it is the primitive to use.
Where it falls short: no UI. Configuration is a TOML file. Small mistakes in the config land as no-DNS moments during a busy afternoon.
Pricing:
- Free: fully free, open source
- Paid: no paid tier
Platforms: Windows, macOS, Linux, BSD
Download: DNSCrypt-Proxy releases
Bottom line: the pick for scripting the whole encrypted DNS stack under source control.
8. Windows 11 DNS over HTTPS
Windows 11 ships a DoH client in Settings → Network & Internet → Ethernet or Wi-Fi → DNS server assignment. Set the DNS to 9.9.9.9 (Quad9), 1.1.1.1 (Cloudflare), 8.8.8.8 (Google), 76.76.2.0 (ControlD), or 94.140.14.14 (AdGuard) and switch DNS encryption from Off to “Encrypted only (DNS over HTTPS)”. The system resolver takes over from there, no third-party client required. This is the setting the XDA article called out and it is the right baseline.
Where it falls short: the picker only recognises a small list of well-known resolvers. Custom DoH endpoints for a NextDNS profile or a private resolver still need a third-party client. No filtering, analytics, or per-app rules.
Pricing: included with Windows 11
Platforms: Windows 11 (Windows 10 has a preview-quality DoH client behind a flag)
Download: Microsoft DoH guide
Bottom line: the free five-minute upgrade every Windows 11 machine should have on, whether or not we add a third-party client on top.
How to pick the right encrypted DNS app on Windows
- If we want the fastest setup with no account: turn on Windows 11 DoH and point it at Cloudflare, Quad9, or ControlD.
- If we want strong content filtering and honest analytics: NextDNS is the pick.
- If we run Chrome, Steam, and a work VPN on the same box and want them on different resolvers: ControlD or YogaDNS.
- If ad blocking is the whole point: AdGuard DNS.
- If we want a free tunnel and a resolver in one: Cloudflare WARP.
- If we want zero cloud accounts: Simple DNSCrypt or DNSCrypt-Proxy with a public DoH resolver.
For most people, the sensible stack is Windows 11 DoH pointed at Cloudflare or Quad9 as the baseline, plus NextDNS or ControlD as the filtering layer for the home network. That way a Wi-Fi switch to a hotel network still gets encrypted queries, and the filtering profile follows the account.
FAQ
Is Windows 11 DoH good enough on its own? For encrypted DNS with no filtering, yes. It hides queries from the LAN and the ISP. If we want ad or tracker blocking, or per-app rules, we still want a third-party resolver or client on top.
Which encrypted DNS resolver is the fastest on Windows? Cloudflare and Google land within a few milliseconds of each other on most home connections in the US and EU. NextDNS and ControlD’s anycast networks are competitive. The right answer is to benchmark against our own network, because ISP peering matters more than a leaderboard.
Does encrypted DNS replace a VPN? No. Encrypted DNS hides the domain we look up but not the IP we connect to. A VPN hides the destination IP as well. For everyday browsing on a home network, encrypted DNS covers the biggest leak. For public Wi-Fi, we want a VPN too.
Can I run encrypted DNS with a home Pi-hole or AdGuard Home? Yes. Point the Pi-hole’s upstream at a DoH or DoT resolver, and let Windows use the Pi-hole as its regular DNS server on the LAN. Some setups run a lightweight DoH client on the desktop for coffee-shop days and the Pi-hole for home.
What is the difference between DoH, DoT, and DoQ? DoH tunnels DNS over HTTPS on port 443, DoT tunnels DNS over TLS on port 853, and DoQ tunnels over QUIC. All three encrypt the query and prevent LAN or ISP snooping. DoH is the best-supported on Windows because it shares port 443 with normal HTTPS traffic.
